EUVD-2026-116358
GHSA-fvq7-38m4-695q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryServe malicious SVG in HTML
-
ExploitTrigger uncontrolled recursion in SVG handling
-
ExecutionExecute arbitrary code within renderer sandbox
-
ImpactContained compromise pending sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires a victim running Chrome before 157.0.8103.38 to actively load attacker-controlled web content - a crafted HTML page embedding malicious SVG (AV:N, PR:N, but UI:R: user must navigate to or render the page). The decisive limiting factor is the sandbox: per the description, code execution is achieved 'inside the sandbox' only, so without a separately chained sandbox-escape vulnerability the attacker cannot reach the host OS or data outside the renderer process. This containment is why Chromium rated the issue Low despite the network-reachable, unauthenticated vector. No non-default configuration is needed - default Chrome rendering is sufficient - but the required user interaction and sandbox boundary materially reduce realistic impact. |
| Impact | Signals conflict and that conflict is the headline. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) produces an 8.8 'High', but Google's own Chromium security team rated this Low, and the description qualifies the outcome as code execution 'inside the sandbox' - a contained renderer-process compromise, not a full host takeover, which would require chaining a separate sandbox-escape bug. The SSVC framework reinforces the lower read: Exploitation=none (no observed or public exploitation), Automatable=no, Technical Impact=total (total only within the affected renderer component). There is no CISA KEV listing, no EPSS score was provided, and none of the four references is a working exploit or PoC - they are the Chrome stable-channel release blog and the Chromium issue tracker entry (restricted). Net: this is a real, patchable bug worth remediating on the vendor's 'this_week' cadence, but it is not an emergency - the CVSS 8.8 overstates real-world impact because it does not credit the sandbox containment that led Chromium to score it Low. Treat the 8.8 as a severity ceiling, not a priority driver. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker hosts a crafted HTML page containing SVG that triggers uncontrolled recursion (CWE-674) in Chrome's SVG handling; a victim who merely visits the page (UI:R) can have attacker-influenced code run within the browser's renderer sandbox. Because impact is confined to the sandbox, meaningful host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit or PoC code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Arbitrary code execution confined to Chrome's renderer sandbox is achievable in Google Chrome builds prior to 157.0.8103.38 when a victim loads a crafted HTML page carrying malicious SVG content. The root cause is uncontrolled recursion (CWE-674) in SVG handling; Chromium itself scored the issue Low severity, CISA's SSVC assessment records exploitation as none and automatable as no, and no public exploit has been identified at time of analysis. The raw CVSS base score of 8.8 should be read alongside our independent assessment, which lowers confidentiality, integrity and availability impact to low because the description limits code execution to 'inside the sandbox' - without a separately chained sandbox escape the attacker cannot reach the host OS or data outside the renderer.
RemediationAI
Vendor-released patch: 157.0.8103.38 - update Google Chrome to 157.0.8103.38 or later via the browser's built-in updater and relaunch so the new binary is loaded, or install the corresponding build from the stable-channel advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html. Because the fix is available, patching this week matches the vuln.today decision label and SSVC shows no known exploitation pressure; the practical residual risk while unpatched is bounded by the renderer sandbox, since code execution stays inside the sandbox unless the attacker also holds a sandbox-escape chain. The supplied sources do not document a specific feature toggle, configuration workaround or port-level mitigation for this defect, so no such control is asserted here; standard browser update and relaunch is the complete remediation path described by the vendor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chromium's SVG rendering pipeline parses and walks nested SVG structures, and this issue is classified as CWE-674, Uncontrolled Recursion - the recursion depth reached while processing attacker-supplied SVG markup is not adequately bounded, which can exhaust stack resources and corrupt process state in a way that may be turned into code execution. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is an unversioned wildcard for the Chrome product, so it identifies the product family rather than a bounded range; the concrete boundary comes from the description and the EUVD record, which place the fix at 157.0.8103.38. The specific SVG construct or recursion path that triggers the flaw is not described in the available sources, and the CVSS vector metrics (AV:N/AC:L/PR:N/UI:R) describe severity and reachability, not the trigger mechanism. The sandbox boundary is the decisive technical containment: exploitation yields code execution within the renderer sandbox only, and real-world impact depends on pairing this with an independent sandbox-escape vulnerability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated but needs user interaction (UI:R), and because code execution is stated as sandbox-contained I lower C/I/A to Low pending a separate escape; scope unchanged (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity vulnerability that allows arbitrary code execution confined to the browser's renderer sandbox when a user visits a malicious webpage. While the sandbox limits impact to the browser process, a successful attack could disrupt user productivity and potentially expose data accessible to the browser. Leadership should prioritize patching to maintain endpoint security and reduce risk of targeted attacks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB